To address the low-quality problem of automatic extraction of ABAC policies, this paper proposed an automatic extraction and optimization enhancement method of ABAC policies driven by access control logs. Firstly, the method constructed an ensemble learning model to map user behavior and permission allocation into a policy logic tree, identifying the relevance and underlying patterns of access authorization decisions to generate preliminary policies. Secondly, the method employed two algorithms of single attribute optimization and rule binary reduction to deeply optimize the policies, simplifying policy structure and compressing policy scale. Finally, the method proposed an error metric-based rule conflict resolution approach to enhance mutually exclusive, complete ABAC policies. Furthermore, the method used policy performance balancing algorithm of a multi-objective optimization to achieve the optimal model selection for different scenario requirements. This paper tested and verified on balanced datasets and sparse datasets respectively, the experimental results demonstrate that the method achieves a highest accuracy of 96.69% on the balanced dataset, compresses the policy scale to 19.7% of the original. On the sparse dataset, the highest accuracy reaches 87.74%, with the policy scale compresses to 23% of the original. This method balances the prediction accuracy and structural simplicity of policies, and is applicable for both balanced logs and sparse logs, ensuring the access control system can implement efficient and secure access authorization management in practical applications.

[2023-08-03] Accepted Paper /doc/2023.06.0232/v1

[2024-02-05] Printed Article /doc/2023.06.0232/v2